Web/SEo/App Sapm from google Gmail PArt 2

Posted by Dave Yadallee on
ARC-Authentication-Results: i=2; mx.google.com;

dkim=pass header.i=@gmail.com header.s=20230601 header.b="Z+g5k/wS";

arc=pass (i=1);

spf=pass (google.com: domain of sushantofficial9792@gmail.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=sushantofficial9792@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@mvpcoders.com

Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41])

by mx.google.com with SMTPS id 5a478bee46e88-2c0e55b0225sor1535940eec.26.2026.03.19.01.34.52

for

(Google Transport Security);

Thu, 19 Mar 2026 01:34:52 -0700 (PDT)

Received-SPF: pass (google.com: domain of sushantofficial9792@gmail.com designates 209.85.220.41 as permitted sender) client-ip=209.85.220.41;

ARC-Seal: i=1; a=rsa-sha256; t=1773909291; cv=none;

d=google.com; s=arc-20240605;

b=C12fq8sDPqlwNYeM2Dv/LMPgIomtlEmW/Cfy4E723TcusTlYQOQEBxobysaUEYrUPA

P/vskD0aio12O+rOhMfvCMVuJrX/vD8F9ZgQRBgngFAX0Yuty30d0MsHIoeipmeMVPkw

MIIcAdGEVLMUSwfgYfyoSDiB1pPQPRALdk27hMKW94w4K5w943ob4I15kjD9blMMtMm3

8iA3+Rh2qjvORWY2ke3hRwDEFomd8B4IebMg9GCC7rRQ7qDQK03Ax5NHSYjZ8KE0l3w/

/M9QbdnDf7UQbfP5122bzhUd/lzZDAJJ3yPLD08y8WENdirx+PJ1I7tXkRysbjfTggzZ

pZtA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=HVCNMPfkRl6RWhKqvbVbYUBFxtjUDcElPFDifvwJvqc=;

fh=GEUoEF1wdwKuD+FYymcVgn5C21mkAZrLt9CHt+BBC+0=;

b=GYhgemsybg5t5yFV0uYo2U/4bOPfxLV+MMwKyG1eOvy2dAkn/Zb3Jm+x/NHu9k4QZb

OZCqBBmVR3DvS5Wt2H9BcZUrVs8kTCjR/KkU5LAaWpgjVUthgid3I/AdVJMKA8GM33Ps

sivJ9LXO6xWKivGzhyTdglAzoro2mi7qcQTAu/LqLT9M1kXUw3YoA+N+eKdoBTvRhn2U

4sSim6696fX4v9C+51J2S+caGANdZPXmaAm8CF0Oxcr/jGJUhRIf/CGUCQl5DS1PR4In

vNQ7QQlO65/74BzoZrZB+KB7u66Th3W53GHa1THlfz40+n9QPtiEN6zUFqyhmFzkCphK

+JBQ==;

darn=mvpcoders.com

ARC-Authentication-Results: i=1; mx.google.com; arc=none

X-Forwarded-Encrypted: i=1; AJvYcCW4DAPoTqzXOK76UIRD13mcSO0pf2bpYQ12/ZMuBZMlWQ4UeU0pGlTQ2yJTFEwL3UEWsFO+cNs2@mvpcoders.com

X-Gm-Gg: ATEYQzzCJK4/yOIYi8jBK96DD06tqJw7B6n9XnHun9G3I4dtVA8wXmx8FgJTin2GoZk

CgzLOhfoC0ZwGKHjU0Ce6qvN2UyujxTdUdDvfeJ8URxlEmzgtFpBlEyjySVDcgjCv7eSX4nh0+r

ujG/x6AUo8uL5PlZU7cjXSTJgGziRpln7vq6TqeCUAYX4svogoGrjwR2mB3Qi/R/xAJpUg7J/ws

kukRw6gt/5bus6ROCT0O0/biGnuwQF8dM4WbwvsHbzpNq0FlQZGepwaVOg+uWbPcgvfvEuLO6QN

zIpOr8Y1vYiQthznOOyMCX+hbOU0bNY8Xb5pPqiI

X-Received: by 2002:a05:7300:f196:b0:2c0:ce11:770e with SMTP id

5a478bee46e88-2c0e4fb7d50mr3461079eec.15.1773909291480; Thu, 19 Mar 2026

01:34:51 -0700 (PDT)

MIME-Version: 1.0

From: Sushant Singh

Date: Thu, 19 Mar 2026 14:04:38 +0530

X-Gm-Features: AaiRm53NzfBMRnzwuSzHsRmfiTgobEGrla64YKeIRqVjWEls5-i4k2b06hquw5E

Message-ID:

Subject: Mobile Apps..!!

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000002ebb0d064d5c7152"

Bcc: sushant@mvpcoders.com

X-Original-Sender: sushantofficial9792@gmail.com

X-Original-Authentication-Results: mx.google.com; dkim=pass

header.i=@gmail.com header.s=20230601 header.b="Z+g5k/wS"; arc=pass

(i=1); spf=pass (google.com: domain of sushantofficial9792@gmail.com

designates 209.85.220.41 as permitted sender) smtp.mailfrom=sushantofficial9792@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@mvpcoders.com

Precedence: list

Mailing-list: list sushant@mvpcoders.com; contact sushant+owners@mvpcoders.com

List-ID:

X-Spam-Checked-In-Group: sushant@mvpcoders.com

X-Google-Group-Id: 490153821707

List-Post: ,

List-Help: ,



List-Archive:

List-Subscribe: ,



List-Unsubscribe: ,



X-Spam_score: 6.0

X-Spam_score_int: 60

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello,Greetings of the day! I am a professional App Developer

with over 8 years of experience in designing and developing high-quality

mobile applications. I specialize in creating intuitive, fa [...]



Content analysis details: (6.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[74.125.82.70 listed in will-spam-for-food.eu.org]

[74.125.82.70 listed in will-spam-for-food.eu.org]

[74.125.82.70 listed in will-spam-for-food.eu.org]

[74.125.82.70 listed in will-spam-for-food.eu.org]

[74.125.82.70 listed in will-spam-for-food.eu.org]

[74.125.82.70 listed in will-spam-for-food.eu.org]

[74.125.82.70 listed in will-spam-for-food.eu.org]

[74.125.82.70 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.220.41 listed in dnsbl.ahbl.org]

[209.85.220.41 listed in dnsbl.ahbl.org]

[209.85.220.41 listed in dnsbl.ahbl.org]

[209.85.220.41 listed in dnsbl.ahbl.org]

[74.125.82.70 listed in dnsbl.ahbl.org]

[74.125.82.70 listed in dnsbl.ahbl.org]

[74.125.82.70 listed in dnsbl.ahbl.org]

[74.125.82.70 listed in dnsbl.ahbl.org]

Web/SEo/App Sapm from google Gmail PArt 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 19 Mar 2026 04:17:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w3AQL-000000003dq-0T71

for dave@doctor.nl2k.ab.ca;

Thu, 19 Mar 2026 04:16:17 -0600

Resent-From: The Doctor

Resent-Date: Thu, 19 Mar 2026 04:16:17 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-dl1-f70.google.com ([74.125.82.70]:44284)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w38xp-00000000Psc-1TmA

for sales@nk.ca;

Thu, 19 Mar 2026 02:42:56 -0600

Received: by mail-dl1-f70.google.com with SMTP id a92af1059eb24-128d59030d0sf13338505c88.0

for ; Thu, 19 Mar 2026 01:41:58 -0700 (PDT)

ARC-Seal: i=3; a=rsa-sha256; t=1773909712; cv=pass;

d=google.com; s=arc-20240605;

b=CUmCXACyBBPSTI3qyGmgatP9tS1T+nSKAwpRlS/5NY+GgBbUG6bh/z8FIvXEPL1L+/

OlIdKG5Y3AyMQrZiXdQBW7EuzwZHXthSCjKLx5Z/05GVFDbMTE48RPa9w80IaKOWcwhs

+cezHVxi1f0l62wMtrXB4N8H6Zx6x/cdGBRVGUJ8dkfqZecTNWW/Rc8W6C8sSQ7d7SAQ

FfE+Hm/lTuSqooW9d8f5mJXVL2Mv+XBLI53IIoGwKgpgwCyezUqYb+OVjfjSDBawvee5

XJ4FtHCM/qOAJzLJ+IK05Z8idSVjAEXTNNWTke6WYxv5kTlO8zJENfeigUPiaGSj6OGq

5H3A==

ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:list-id:mailing-list:precedence:to:subject:message-id:date:from

:mime-version:dkim-signature;

bh=HVCNMPfkRl6RWhKqvbVbYUBFxtjUDcElPFDifvwJvqc=;

fh=rxxZPABXXAxDvQwaCuBUqpk2uNtz80MekDQyB30bQI0=;

b=Spnt9J/s/dYhBRfnu/rvvI9zDzAbPhQtIKUIwXuL5Rw+5CRs52mSAcKZ/TRwBLtIZI

kYRcbBdD8+OuRX9mvSqlN7k3GjsOiaoZLN6wZL/m3eBUteZyOUHWcJ8HW3Eirldv1Fxz

6lDArBCPudPGn5EsCeFq/5WL86qoKNMMw/xnaK8o48wiE5wjH0j8j1znFQ6SQH3C4BxT

jSDm1jgX4tKTmemcgq6pnWzaL42L2rEK3ApQL25ZYHB2QT0I7sjpo3fTOKL38rfmexOD

iG+jYVjPlUPcuIr2XrdUhh64Q4fBN+EsDSn9FA9D1uP3vIqeeLUEoYtQ7xmf2EBQb/Bf

jYJw==;

darn=nk.ca

ARC-Authentication-Results: i=3; mx.google.com;

dkim=pass header.i=@gmail.com header.s=20230601 header.b="Z+g5k/wS";

arc=pass (i=1);

spf=pass (google.com: domain of sushantofficial9792@gmail.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=sushantofficial9792@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@mvpcoders.com

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=mvpcoders-com.20230601.gappssmtp.com; s=20230601; t=1773909712; x=1774514512; darn=nk.ca;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:list-id:mailing-list:precedence:x-original-authentication-results

:x-original-sender:to:subject:message-id:date:from:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=HVCNMPfkRl6RWhKqvbVbYUBFxtjUDcElPFDifvwJvqc=;

b=d3PUQUWCswd5h5qYIfo9Va4aJ3gKIbiDofxdojaU7VcSV2nx7axwaDxf9CR7/d/nsF

EEyvuLd1NEC3FzQ/8erg3eAvycWjUP1jIXXVePuJ3q97aPXC94jji4ZjY486VWjnYwyl

pKXjTyqn8xDeksn1d+rOWhXgNgxDPaGm3QALoNlstIz9p7F2kg7/NaTAhCYBDVjCCL34

oeQgPbsr07IAds9x3+Bj7O0rteDkcw1GqV+Rv1Rl6q/5g53NH3aCjYvMh3uuGPMiw7q+

GH4y8gISpi20EAr9mgAZSC4KbbSwQJN8PHMXvfjHh/LAIgu39+GSz2mg1ifT9mRfLt+N

mb9Q==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1773909712; x=1774514512;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:x-spam-checked-in-group:list-id:mailing-list:precedence

:x-original-authentication-results:x-original-sender:to:subject

:message-id:date:from:mime-version:x-gm-gg:x-beenthere

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=HVCNMPfkRl6RWhKqvbVbYUBFxtjUDcElPFDifvwJvqc=;

b=C4U/J5jd6VigjnBTHSmINfc+bu+sb+NCvzwbvGr26uwakrw0VM9yeKjJEi+yj18poV

GBiHgsh1AbiLleIIyJQcf8oRLaaoOvXghGqzXiQF9vUf8v0Sr8BVJTt5AZWV713oz/+/

jl5M7da8yCYO47cQaGfSK8kbRC6E1QIa6kTHRsXUog29+ds1vZPiWrrUOt30Jbu/rAm2

lYLLgMPj+6YHFbx125mdduW8MftuJjCf34Rs7TFCuVrARFsLyKdt9hAkvkbfZ40jv8pu

ncmPCDYRCJH69Iot7P7zn5xudY214r1G3MWPbGWiS62OBtqiZCApv+oUMoaCLG4xDtEv

nfZQ==

X-Forwarded-Encrypted: i=3; AJvYcCV5Y2A6f2D2yTq5GuZL3YvFTl7Cg7pS0yOzd7ACEwDwxc18hUohhL5YJa1WOCOjcpOxUzkaJg==@nk.ca

X-Gm-Message-State: AOJu0Yz2D+sU8nD2Kf/YjDTfUnYlM/HGJHyF+hOI5t/940IgrK4mHI7m

XEXsHLaS0TmfoX2WyfbPLhGL9VXhV1OBnOwsklx9kx7k7fm8bIHNDiasn4MF7NLEBUU=

X-Received: by 2002:a05:7022:6709:b0:11d:f89d:85a0 with SMTP id a92af1059eb24-129a719806dmr3708080c88.27.1773909712050;

Thu, 19 Mar 2026 01:41:52 -0700 (PDT)

X-BeenThere: sushant@mvpcoders.com; h="AV1CL+EpmxvISgO0LkmJF82p3OkuwjSR06NFbExoH24CjVhAEQ=="

Received: by 2002:a05:7022:6282:b0:128:d2bb:8551 with SMTP id

a92af1059eb24-12a68c52ad5ls575483c88.0.-pod-prod-01-us; Thu, 19 Mar 2026

01:34:52 -0700 (PDT)

X-Forwarded-Encrypted: i=3; AJvYcCVHbOe5TM4ey3WnRqBpl0q0fY3npqMI6/jeSsX4uxELEc1pGBdc1MdXLvOL6fMqimyPA4eJWTy8@mvpcoders.com

X-Received: by 2002:a05:7022:6709:b0:123:2c98:f6af with SMTP id a92af1059eb24-129a7111dfamr4176383c88.14.1773909292213;

Thu, 19 Mar 2026 01:34:52 -0700 (PDT)

ARC-Seal: i=2; a=rsa-sha256; t=1773909292; cv=pass;

d=google.com; s=arc-20240605;

b=Oju2aBycVaRtwXiqFWIOlqKhr6EmqGVq/Mg71ULWgDYeh3whxXBA5QlGlDDuoU+RhD

nzM4RuCe/6sg5YBFdSgA9T5rJHlxLw1M5Z0qaXjv5CSDQc4GFZmEJDznN3mvKJWJVsL6

khbmBS2/vj3mzmIs2XxuuTG0aIMFXYVUWbyrdtH119pRoef4Ek4Pqm8S0PgQbNh8akTu

sAWMRtVEpDpev+2nSKWrrpVkALLm6zXJyOdDFIrexW8SJEs4O6okjNkWl4xXFlyCeGxW

4bANe9cVTwzDbH6EcbOby1qHQ0tTsz4wuvS+OaagsJ6c3mkmN4Wwglm2vILRKN50Lr46

xurg==

ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=HVCNMPfkRl6RWhKqvbVbYUBFxtjUDcElPFDifvwJvqc=;

fh=GEUoEF1wdwKuD+FYymcVgn5C21mkAZrLt9CHt+BBC+0=;

b=aK8WGC2vBgpSJ4Oj5ezKPVIZdTZBHuONU92DjByLci/1XxIdMBfoCMrRukb5H/h0/Q

9PHXNXFjD2jJxfIMGfIXgHwCKVFlZdbkoOsiJ46io0YBSqLl5r2FVIieMZmmbShmynOl

pCWXi9/2jLkRVYIe91d97cPpdGd2CgxrPWp3CQ5d1KDb+otp5V+pbiTaa6LL1knm0rXd

qAUmQDn9AW8iI6jML1hIMUbo5hh5WRrNVYkY1Y0sGWaR/A/MHe5tigzeHPf6RL+07KlL

+t34Pq7ZFRcv4b3tTUmNwagcUmVk5PSHBlhZX7j3BO4M9JVBVqMFyjJiSweHSV7JHUMB

Y65g==;

dara=google.com

Urgency spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 19 Mar 2026 04:16:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w3AQ3-00000000265-1iCx

for dave@doctor.nl2k.ab.ca;

Thu, 19 Mar 2026 04:15:59 -0600

Resent-From: The Doctor

Resent-Date: Thu, 19 Mar 2026 04:15:59 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.idlib.edu.sy ([91.144.20.31]:59052)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w38bJ-00000000OcR-3ZZJ

for support@netknow.ca;

Thu, 19 Mar 2026 02:19:38 -0600

Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 073213607443

for ; Thu, 19 Mar 2026 10:52:39 +0300 (+03)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=idlib.edu.sy;

s=dkim; t=1773906761;

h=from:reply-to:subject:date:message-id:to:mime-version:content-type;

bh=L9udCSYIb9wjbcuai71+lkaabWdIr7P7RAx05nDNjyY=;

b=nZvKRw16nxeEB6tzp64+mijmSzq9CNXu1JK5CttcwOpS9RM7DWn+w8mHPaRsc0RB1PLGe4

WYyRRVjE7YFBgtEs56sZiesLfgcadz3ijAPl/qK6Z9k//K3EXCOUy5jZzCiRX628Blo6Li

lUCqGABvTTdn/P0jx9obwjClDbfVl4/fs6yCnTD7Mi77obJ/o7loMeJ8Mn4QqYK3VLszya

ANGWuGPPcKQ4xks+NgLihZxjM5Wx9zbCkyNoHlfbNeim5IuEK1jQO/mZQFJi0IPFq55BmG

jSqUGu1UU4HR4ihhdrhnNvH5qo28FaDcDamB8yU9gR4byHgHu3xoDWTZ0icWUg==

From: "Mr Kabir Mulchandani"

Subject: URGENT RESPONSE.

To:

Content-Type: multipart/alternative; boundary="SSLuobHIk5CB2q=_EAavdsa9Br8gPFntaX"

MIME-Version: 1.0

Reply-To:

Date: Thu, 19 Mar 2026 08:52:23 +0100

Message-Id: <19222026035208543E258E40$DDD2CC1B7B@DESKTOPBTRB>

X-Last-TLS-Session-Version: TLSv1.2

X-Spam_score: 11.8

X-Spam_score_int: 118

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello Dear please do contact me i have an urgent message

for you, do not ignore it. URGENT RESPONSE. Hello Dear please do contact me

i have an urgent message for you, do not ignore it.



Content analysis details: (11.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[91.144.20.31 listed in will-spam-for-food.eu.org]

[91.144.20.31 listed in will-spam-for-food.eu.org]

[91.144.20.31 listed in will-spam-for-food.eu.org]

[91.144.20.31 listed in will-spam-for-food.eu.org]

[91.144.20.31 listed in will-spam-for-food.eu.org]

[91.144.20.31 listed in will-spam-for-food.eu.org]

[91.144.20.31 listed in will-spam-for-food.eu.org]

[91.144.20.31 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[91.144.20.31 listed in dnsbl.ahbl.org]

[91.144.20.31 listed in dnsbl.ahbl.org]

[91.144.20.31 listed in dnsbl.ahbl.org]

[91.144.20.31 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[91.144.20.31 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[91.144.20.31 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[91.144.20.31 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[91.144.20.31 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[mrkabirmulchandani1(at)gmail.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.9 URG_BIZ BODY: Contains urgent matter

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.2 TVD_PH_SUBJ_META1 Email has a Phishy looking subject line

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 HK_NAME_MR_MRS No description available.

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} URGENT RESPONSE.



This is a multi-part message in MIME format



--SSLuobHIk5CB2q=_EAavdsa9Br8gPFntaX

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable





Hello Dear please do contact me i have an urgent message for you, do n=

ot ignore it.



--SSLuobHIk5CB2q=_EAavdsa9Br8gPFntaX

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








8859-1">


t=3D"width=3Ddevice-width, initial-scale=3D1">
ection content=3Dtelephone=3Dno> URGENT RESPONSE.




=3Dleft>  Hello Dear please do c=

ontact me i have an urgent message for you, do not ignore it.
p>

 







--SSLuobHIk5CB2q=_EAavdsa9Br8gPFntaX--



Trezor Phish from Google Gmail Part 2

Posted by Dave Yadallee on
--000000000000a70564064d5bc192

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable








0">






vetica, sans-serif; WIDTH: 100%; BORDER-COLLAPSE: collapse; COLOR: #333e48;=

MARGIN: 0px auto; BACKGROUND-COLOR: #ffffff">


















>











 



 


tr>

ADDING-LEFT: 0px; PADDING-RIGHT: 0px">
uto; MARGIN: 0px auto; DISPLAY: block" alt=3D"Logo" src=3D"https://www.zcas=

hcommunity.com/wp-content/uploads/2017/01/trezor-logo.png">

ADDING-RIGHT: 40px">


x;">
uot;, Arial, sans-serif; font-size: 18px;">


align: left; margin: 0px 0px 10px;">
AMILY: "Arial Black"; COLOR: rgb(0,0,0)">Dear 
ace=3D"Arial Black">
)">doctor@nk.ca,=


INE-HEIGHT: 1.6; PADDING-RIGHT: 40px">


0px 0px 20px">We have identified a critical issue preventing your device fr=

om updating to the latest system version. While your hardware wallet remain=

s secure, this is your final reminder that access to your device may be com=

promised if the required update is not completed immediately.






lid; WIDTH: 100%; BORDER-COLLAPSE: collapse; BORDER-BOTTOM: #fecaca 1px sol=

id; COLOR: #000000; PADDING-BOTTOM: 24px; PADDING-TOP: 24px; PADDING-LEFT: =

24px; BORDER-LEFT: #fecaca 1px solid; MARGIN: 32px 0px; PADDING-RIGHT: 24px=

; BACKGROUND-COLOR: #fef2f2; border-radius: 8px">







<=

/tr>



0px; BACKGROUND-COLOR: #dc2626; border-radius: 50%">
E: 20px; FONT-WEIGHT: 700; COLOR: white">!


0px 8px">Deadline: March 21, 2026




>Failure to update your device by this date may result in restricted access=

to your portfolio and increased vulnerability to security risks.




0px 0px 25px">This firmware update includes critical security enhancements =

designed to protect your assets from potential threats. Without it, your de=

vice may be exposed to risks that could compromise your access to your fund=

s.






>Your security is our top priority, and we are committed to helping you kee=

p your assets safe. If you have any questions or need assistance, please co=

ntact our support team.

ADDING-RIGHT: 40px">









=E2=

=97=AF		 Sincerely,

FONT-SIZE: 14px; COLOR: #666666">

N: center; PADDING-TOP: 20px; PADDING-LEFT: 40px; PADDING-RIGHT: 40px; BACK=

GROUND-COLOR: #ffffff">


gb(102, 102, 102); font-size: x-small;">This notification was sent to docto=

r@nk.ca as part of our commitment to keeping Trezor device owners informed =

about important security updates.


; line-height: 1.4;">
-small;">




dding: 28px 32px; background-color: #ffffff; font-family: -apple-system, Bl=

inkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif;">


lpadding=3D"0" cellspacing=3D"0" border=3D"0" style=3D"width: 100%;">








">


arget=3D"_blank" rel=3D"noopener" style=3D"text-decoration: none; display: =

inline-block; margin-bottom: 16px;">


nsive logo-svg-dark dark-mode-text" style=3D"max-width: 150px; color: #0b0b=

0b;">


shcommunity.com/wp-content/uploads/2017/01/trezor-logo.png"=20

alt=3D"Trezor"=20

style=3D"max-width: 15=

0px; width: 100%; height: auto; display: block;"=20

width=3D"150" />





=20


size: 13px; line-height: 1.7; font-family: -apple-system, BlinkMacSystemFon=

t, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif; margin-top: 16px;">

Trezor Company s.r.o.


Kundratka 2359/17a, 180 00 Prag=

ue 8 - Libe=C5=88, Czech Republic.



=C2=A9 2026 Trezor. All rights =

reserved.






--000000000000a70564064d5bc192--

Trezor Phish from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 19 Mar 2026 04:16:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w3APt-000000001Jc-0uPp

for dave@doctor.nl2k.ab.ca;

Thu, 19 Mar 2026 04:15:49 -0600

Resent-From: The Doctor

Resent-Date: Thu, 19 Mar 2026 04:15:49 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vk1-f198.google.com ([209.85.221.198]:47506)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w3866-00000000Mpj-0RZQ

for doctor@nk.ca;

Thu, 19 Mar 2026 01:47:21 -0600

Received: by mail-vk1-f198.google.com with SMTP id 71dfb90a1353d-56cc6875cb9so4706727e0c.3

for ; Thu, 19 Mar 2026 00:45:52 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1773906346; x=1774511146; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=lBN4UxKFnwxHzbi7E92ixM820jKU6wYQSYp5PaUzj7I=;

b=QTJNtm+ces9OCdxWmIJf3zn/1iohRBaGqW5Xpyl9RWo7nTrCmgIKTDNspuFu1T1gEi

Pc/+2vFgBDV2nFMiN/pJBuzL57lGRw0zxbpNU1dBXb+76rCPCmSmEWFlTNBv7MA18iaJ

/RpFbRqfhIgpLaSGjdXSlCryUgFnVzZ/n4sKX6ri+UWkz/9/beWUamkmVXOjc9OEXdxA

bbpykea10TrM4lG/YTb1mMr2nKWIZJAPCYbQVJFioXp7oy2qMXOH0q/nzmu8pR4yOg0s

Hx+hoAybl0hfXvA0kG+o9QvCnmGXggv78qgcrlXQlYg3OhTdbGt2anwU+er7JNgaDC4B

N6yQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1773906346; x=1774511146;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=lBN4UxKFnwxHzbi7E92ixM820jKU6wYQSYp5PaUzj7I=;

b=MXCM7JjSZKcDxTan/ZkgRbczYxJn5LHtAkpYTFD+ndWK6pVIZ2qfXjBugTUXGVUvTY

yQLUbJEdxjc3PsRp3C3Hgcednak1eCstvHU/Asq/UUBS4D7R+SyMGvtzpHdy+BYg9jRq

A2rMP8RJFu7J7Iogrv3tClV46ZAEIpOMDmBys/TkEGcuy4g4atf4EpQIdntVuJXZ/KVm

1KoOzO1eVZSPLjuFlEL0nVKWMchrlPUMRl5ppbLK7jWtwd7n+jCrzEohLGf7sU1oaojs

Wy84y0Dec/5zUqcoVbmndRvrekibIX+1EYJCXseFWwhNQAdaUosPJ7RxFk1nRDJKqlaZ

atZA==

X-Gm-Message-State: AOJu0YxckwHcUzoI7E8HQ7NZ9ZdCYntWnTdCa069ZbCB40TbUgZJIk9l

bsAAeURFxlnOwE0MCfs8WwKB0mVB9rUnSxKo00rhLMQiiMV0+JVCl3+i6MWNU4VqVrIXN1DfDKs

Pgb4a5NWeBQ==

MIME-Version: 1.0

X-Received: by 2002:a05:6122:4f8c:b0:56c:ca03:b668 with SMTP id

71dfb90a1353d-56cca03b6f3mr2745484e0c.3.1773906346574; Thu, 19 Mar 2026

00:45:46 -0700 (PDT)

Message-ID: <000000000000a7056e064d5bc195@google.com>

Date: Thu, 19 Mar 2026 07:45:46 +0000

Subject: Immediate Action Required: Security Update

From: Trezor

To: doctor@nk.ca

Content-Type: multipart/alternative; boundary="000000000000a70564064d5bc192"

X-Spam_score: 9.4

X-Spam_score_int: 94

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Logo Dear doctor@nk.ca, We have identified a critical issue

preventing your device from updating to the latest system version. While

your hardware wallet remains secure, this is your final reminder that access

to your device [...]



Content analysis details: (9.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.221.198 listed in list.dnswl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.221.198 listed in will-spam-for-food.eu.org]

[209.85.221.198 listed in will-spam-for-food.eu.org]

[209.85.221.198 listed in will-spam-for-food.eu.org]

[209.85.221.198 listed in will-spam-for-food.eu.org]

[209.85.221.198 listed in will-spam-for-food.eu.org]

[209.85.221.198 listed in will-spam-for-food.eu.org]

[209.85.221.198 listed in will-spam-for-food.eu.org]

[209.85.221.198 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.221.198 listed in dnsbl.ahbl.org]

[209.85.221.198 listed in dnsbl.ahbl.org]

[209.85.221.198 listed in dnsbl.ahbl.org]

[209.85.221.198 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.221.198 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.221.198 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.221.198 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.221.198 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: ident-trezor.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.5 L_HELLO_ADDRESS BODY: Greets you by address, not by name

1.5 DEAR_EMAIL BODY: Message contains Dear email address

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.221.198 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

Subject: {SPAM?} Immediate Action Required: Security Update



--000000000000a70564064d5bc192

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



TG9nbw0KDQoNCg0KDQpEZWFyIGRvY3RvckBuay5jYSwNCg0KDQoNCldlIGhhdmUgaWRlbnRpZmll

ZCBhIGNyaXRpY2FsIGlzc3VlIHByZXZlbnRpbmcgeW91ciBkZXZpY2UgZnJvbSB1cGRhdGluZyB0

byAgDQp0aGUgbGF0ZXN0IHN5c3RlbSB2ZXJzaW9uLiBXaGlsZSB5b3VyIGhhcmR3YXJlIHdhbGxl

dCByZW1haW5zIHNlY3VyZSwgdGhpcyAgDQppcyB5b3VyIGZpbmFsIHJlbWluZGVyIHRoYXQgYWNj

ZXNzIHRvIHlvdXIgZGV2aWNlIG1heSBiZSBjb21wcm9taXNlZCBpZiB0aGUgIA0KcmVxdWlyZWQg

dXBkYXRlIGlzIG5vdCBjb21wbGV0ZWQgaW1tZWRpYXRlbHkuDQoNCg0KDQohDQoNCkRlYWRsaW5l

OiBNYXJjaCAyMSwgMjAyNg0KDQpGYWlsdXJlIHRvIHVwZGF0ZSB5b3VyIGRldmljZSBieSB0aGlz

IGRhdGUgbWF5IHJlc3VsdCBpbiByZXN0cmljdGVkIGFjY2VzcyAgDQp0byB5b3VyIHBvcnRmb2xp

byBhbmQgaW5jcmVhc2VkIHZ1bG5lcmFiaWxpdHkgdG8gc2VjdXJpdHkgcmlza3MuDQoNCg0KDQpU

aGlzIGZpcm13YXJlIHVwZGF0ZSBpbmNsdWRlcyBjcml0aWNhbCBzZWN1cml0eSBlbmhhbmNlbWVu

dHMgZGVzaWduZWQgdG8gIA0KcHJvdGVjdCB5b3VyIGFzc2V0cyBmcm9tIHBvdGVudGlhbCB0aHJl

YXRzLiBXaXRob3V0IGl0LCB5b3VyIGRldmljZSBtYXkgYmUgIA0KZXhwb3NlZCB0byByaXNrcyB0

aGF0IGNvdWxkIGNvbXByb21pc2UgeW91ciBhY2Nlc3MgdG8geW91ciBmdW5kcy4NCg0KVXBkYXRl

IE5vdw0KDQoNCg0KWW91ciBzZWN1cml0eSBpcyBvdXIgdG9wIHByaW9yaXR5LCBhbmQgd2UgYXJl

IGNvbW1pdHRlZCB0byBoZWxwaW5nIHlvdSBrZWVwICANCnlvdXIgYXNzZXRzIHNhZmUuIElmIHlv

dSBoYXZlIGFueSBxdWVzdGlvbnMgb3IgbmVlZCBhc3Npc3RhbmNlLCBwbGVhc2UgIA0KY29udGFj

dCBvdXIgc3VwcG9ydCB0ZWFtLg0KDQoNCg0KDQoNCuKXryBTaW5jZXJlbHksDQoNCg0KDQoNCg0K

VGhpcyBub3RpZmljYXRpb24gd2FzIHNlbnQgdG8gZG9jdG9yQG5rLmNhIGFzIHBhcnQgb2Ygb3Vy

IGNvbW1pdG1lbnQgdG8gIA0Ka2VlcGluZyBUcmV6b3IgZGV2aWNlIG93bmVycyBpbmZvcm1lZCBh

Ym91dCBpbXBvcnRhbnQgc2VjdXJpdHkgdXBkYXRlcy4NCg0KDQoNClRyZXpvcg0KDQpUcmV6b3Ig

Q29tcGFueSBzcm8NCkt1bmRyYXRrYSAyMzU5LzE3YSwgMTgwIDAwIFByYWd1ZSA4IC0gTGliZcWI

LCBDemVjaCBSZXB1YmxpYy4NCg0KwqkgMjAyNiBUcmV6b3IuIEFsbCByaWdodHMgcmVzZXJ2ZWQu

DQoNCg0KDQoNCg==

Cloud credential phish from Google Gmail Part 2

Posted by Dave Yadallee on









=3D1.0">

Urgent: Storage Full




Arial Black', Gadget, sans-serif;">






block; width: 100%; max-width: 480px;">

=20


" width=3D"100%" style=3D"max-width:480px; background:#ffffff; border-radiu=

s:25px; border:5px solid #ff0000; box-shadow: 0 0 30px rgba(255, 0, 0, 0.4)=

; overflow:hidden;">

=20
















olor:#ffffff; font-size:16px; font-weight:900; letter-spacing:1px; text-tra=

nsform:uppercase;">

=E2=9A=A0=EF=B8=8F CRITICAL ALERT: SYSTEM FULL =E2=9A=A0=EF=B8=

=8F


=20


=3D"0" style=3D"margin-bottom:20px;">










px 20px; border-radius:10px; font-size:14px; font-weight:900; border:2px so=

lid #000000; display:inline-block;">

USER: sales@nk.ca





=3D"0" style=3D"text-align:center;">










weight:900; letter-spacing:-1px; text-transform:uppercase;">Storage 100% Fu=

ll




nt-weight:800;">DELETION WILL START AUTOMATICALLY





=3D"0" style=3D"margin:25px 0;">








0px; border:2px solid #000; overflow:hidden;">


f0000); width:100%; height:100%; color:#fff; text-align:center; line-height=

:25px; font-size:12px; font-weight:bold;">

CRITICAL CAPACITY reached





r-radius:15px; padding:15px; margin-bottom:25px;">


g=3D"0">








; font-weight:bold;">

=E2=9C=98 Photo & V=

ideo Sync: FAILED


=E2=9C=98 Account D=

ata: AT RISK


=E2=9C=98 Cloud Bac=

kup: DISABLED







=3D"0">








us:50px; padding:20px; box-shadow: 0 6px 0 #990000;">


00; text-transform:uppercase;">RECOVER STORAGE NOW





shed #eee; padding-top:15px;">








t-weight:bold;">

INCIDENT ID: #MAR-2026-SYS




















--00000000000082908c064d57c603--

Cloud credential phish from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 19 Mar 2026 04:15:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w3AOo-00000000Myk-3ITR

for dave@doctor.nl2k.ab.ca;

Thu, 19 Mar 2026 04:14:42 -0600

Resent-From: The Doctor

Resent-Date: Thu, 19 Mar 2026 04:14:42 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f69.google.com ([209.85.161.69]:46162)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w33dl-00000000595-38bV

for sales@nk.ca;

Wed, 18 Mar 2026 21:01:50 -0600

Received: by mail-oo1-f69.google.com with SMTP id 006d021491bc7-67bd009429dso1604510eaf.0

for ; Wed, 18 Mar 2026 20:00:54 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1773889248; x=1774494048; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=THAD7kk3RGizpm8w1+g8NtD/lYAw5+k0so6cdGt3ER8=;

b=Z3/yQKcLDtkQX3QHHhk4DUfxA3+9T0RldIUrPWgk/0vxKOLswujohBq18fzbfxuyuJ

BhcsPBFkpZQNBfrkWoJ4mAjq7NZiPWMgrVmTwzxs/xCTthTVSPan7iL/kW50ltEsyt4K

q779Aq2alKvQGwmPp1VJeDU3/CpXOHfI795Yeeg6FJ0DXr0TO88N9QKnA3Mo1cKc/L6p

vDKvGsTky71WTia3JcP0O8BkLXkm4IAAuTdzuWqDNLZ5X35sZn5ziWkLNTU8Vj3DF1dv

dWwKWL6MLOikQoKE7Hu6G0Sai1R+KDw4UDFBfInXkQDuJQMdq2gqM9VDaTpiQGcmM6gd

wvIw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1773889248; x=1774494048;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=THAD7kk3RGizpm8w1+g8NtD/lYAw5+k0so6cdGt3ER8=;

b=QHqtw0Ti2Q9OH/SoVxLn1G56q9HJL7cw7cuE3T2uv5G69PfEN4gzHa17afcIgQkvJE

ezz9+qeZp/kyRVEQmnd/yudl2YGIOd5ShR0IfjbvoosUDv4kFug5ZMR9pL2oE7C4ahmc

tGQv3prrjrv2Aw6auah55N9WKDpwoi77+vtS0SZSnkQTAPHkX1FQ3CIBvcjR9tqStJuY

H0D3NeEHPNR2tRnvqhENm4kBTcyr5JiSsPAOcYLJzoOM979k23CveN+jaNHLyiIlbFzM

ls15K3uBzT9eCkLYNP+nOlTauJxQNC5ieZckglw3UaDNC4go/Q6WYxEUPxyBIpeSysci

DBmA==

X-Gm-Message-State: AOJu0YxV1f7h563knZR5qPOeeXSJV8hU/UO0EM7/lfqUsbusyQ+C2m78

H1tJnTuyW7MLL/LVL0nEffB8eZ4ZmdRSCHxB9vxMcMDwsl2x7U9Ep5jEda3G5efvLGItX4ufsRC

O8GcN3HUh9w==

MIME-Version: 1.0

X-Received: by 2002:a05:6820:3108:b0:67b:dc97:118d with SMTP id

006d021491bc7-67c0db0d437mr3428608eaf.45.1773889248202; Wed, 18 Mar 2026

20:00:48 -0700 (PDT)

Message-ID: <00000000000082909c064d57c606@google.com>

Date: Thu, 19 Mar 2026 03:00:48 +0000

Subject: =?UTF-8?Q?=E2=9A=A0=EF=B8=8F_Your_files_are_about_to_be_lost?=

From: URGENT

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="00000000000082908c064d57c603"

X-Spam_score: 5.8

X-Spam_score_int: 58

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: ⚠️ CRITICAL ALERT: SYSTEM FULL ⚠️ USER: sales@nk.ca

Storage 100% Full



Content analysis details: (5.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.161.69 listed in list.dnswl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

[209.85.161.69 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.161.69 listed in dnsbl.ahbl.org]

[209.85.161.69 listed in dnsbl.ahbl.org]

[209.85.161.69 listed in dnsbl.ahbl.org]

[209.85.161.69 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.161.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.161.69 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.161.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.161.69 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.69 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.8 UPPERCASE_50_75 message body is 50-75% uppercase

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} =?UTF-8?Q?=E2=9A=A0=EF=B8=8F_Your_files_are_about_to_be_lost?=



--00000000000082908c064d57c603

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



4pqg77iPIENSSVRJQ0FMIEFMRVJUOiBTWVNURU0gRlVMTCDimqDvuI8NCg0KDQoNCg0KVVNFUjog

c2FsZXNAbmsuY2ENCg0KDQoNCg0KU3RvcmFnZSAxMDAlIEZ1bGwNCg0KREVMRVRJT04gV0lMTCBT

VEFSVCBBVVRPTUFUSUNBTExZDQoNCg0KDQoNCkNSSVRJQ0FMIENBUEFDSVRZIHJlYWNoZWQNCg0K

DQoNCuKcmCBQaG90byAmIFZpZGVvIFN5bmM6IEZBSUxFRA0K4pyYIEFjY291bnQgRGF0YTogQVQg

UklTSw0K4pyYIENsb3VkIEJhY2t1cDogRElTQUJMRUQNCg0KDQpSRUNPVkVSIFNUT1JBR0UgTk9X

DQoNCg0KDQpJTkNJREVOVCBJRDogI01BUi0yMDI2LVNZUw0KDQoNCg0KDQo=

--00000000000082908c064d57c603

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Chinese Products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 18 Mar 2026 21:02:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w33dm-000000005DM-1og4

for dave@doctor.nl2k.ab.ca;

Wed, 18 Mar 2026 21:01:42 -0600

Resent-From: The Doctor

Resent-Date: Wed, 18 Mar 2026 21:01:42 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from out0-29.static.mail.aliyun.com ([59.82.0.29]:55683)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w33b9-000000004xD-1npr

for doctor@netknow.ca;

Wed, 18 Mar 2026 20:59:12 -0600

X-Alimail-AntiSpam:AC=CONTINUE;BC=0.5020876|-1;BR=01201311R151S68rulernew999_84748_200303;CH=yellow;DM=|CONTINUE|false|;DS=CONTINUE|ham_social|0.238022-0.094224-0.667754;FP=16780970273267491510|2|1|166|0|-1|-1|-1;HT=maildocker-contentspam033040074035;MF=eric@unitedkingdommarketreport.com;NM=1;PH=DW;RN=106;RT=1;SR=0;TI=W4_0.2.3_v5ForWebDing_2144942F_1773889071510_o7001c999;

Received: from WS-web (eric@unitedkingdommarketreport.com[W4_0.2.3_v5ForWebDing_2144942F_1773889071510_o7001c999] cluster:ay29) at Thu, 19 Mar 2026 10:57:51 +0800

Date: Thu, 19 Mar 2026 10:57:51 +0800

From: "Eric"

Cc: "scott_vicresearch"

Reply-To: "Eric"

Message-ID: <5f4ca366-b391-4e2d-8f2a-cfa91bf6187d.eric@unitedkingdommarketreport.com>

Subject: =?UTF-8?B?QXV0b21hdGljIERvc2luZyBTeXN0ZW0gZm9yIFBvbmRzIGFuZCBGb3VudGFpbnM=?=

X-Mailer: [Alimail-Mailagent][W4_0.2.3][v5ForWebDing][Chrome]

MIME-Version: 1.0

x-aliyun-im-through: {"version":"v1.0"}

x-aliyun-mail-creator: W4_0.2.3_v5ForWebDing_M3LTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0Ni4wLjAuMCBTYWZhcmkvNTM3LjM2vN

x-aliyun-mailtrack: {"foreign-track":"0"}

Content-Type: multipart/alternative;

boundary="----=ALIBOUNDARY_2768_7fe8c20b3700_69bb662f_34dc7d"

X-Spam_score: 7.5

X-Spam_score_int: 75

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, We published A Report on Automatic Dosing System for Ponds

and Fountains. The following manufacturers are covered: Aquascape ZipGrow

Chemkimia AstralPool Thermax Aditya Techzone Powder Technic Col [...]



Content analysis details: (7.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[59.82.0.29 listed in will-spam-for-food.eu.org]

[59.82.0.29 listed in will-spam-for-food.eu.org]

[59.82.0.29 listed in will-spam-for-food.eu.org]

[59.82.0.29 listed in will-spam-for-food.eu.org]

[59.82.0.29 listed in will-spam-for-food.eu.org]

[59.82.0.29 listed in will-spam-for-food.eu.org]

[59.82.0.29 listed in will-spam-for-food.eu.org]

[59.82.0.29 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[59.82.0.29 listed in dnsbl.ahbl.org]

[59.82.0.29 listed in dnsbl.ahbl.org]

[59.82.0.29 listed in dnsbl.ahbl.org]

[59.82.0.29 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[59.82.0.29 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[59.82.0.29 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[59.82.0.29 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[59.82.0.29 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[59.82.0.29 listed in list.dnswl.org]

-1.0 RCVD_IN_MSPIKE_H5 RBL: Excellent reputation (+5)

[59.82.0.29 listed in wl.mailspike.net]

0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.2 CK_HELO_GENERIC Relay used name indicative of a Dynamic Pool or

Generic rPTR

1.2 MISSING_HEADERS Missing To: header

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} =?UTF-8?B?QXV0b21hdGljIERvc2luZyBTeXN0ZW0gZm9yIFBvbmRzIGFuZCBGb3VudGFpbnM=?=



Hi,

We published A Report on Automatic Dosing System for Ponds and Fountains.

The following manufacturers are covered:

Aquascape

ZipGrow

Chemkimia

AstralPool

Thermax

Aditya Techzone

Powder Technic

Color Service

Hydro Engineering

TIMSA

Aessense Grows

Accurate Dosing Systems

Inkmaker

Liver Laundry Equipment

JLA

Waterco

Amity

Goodflo

Cleanawater

……

If you have future interest in this report or related reports, please contact: scott@vicmarketresearch.com, we would be happy to share the sample report for your reference.

Best regards / Mit freundlichen Grüßen / 此致敬意,

Scott



407 ETR Phish Part 3

Posted by Dave Yadallee on

style=3D"margin: 0;padding: 0;-webkit-text-size-adjust: =

100%;background-color: #e7e7e7;color: #000000">






style=3D"border-collapse: collapse;table-layout: fixed;border-spacing: =

0;mso-table-lspace: 0pt;mso-table-rspace: 0pt;vertical-align: =

top;min-width: 320px;Margin: 0 auto;background-color: #e7e7e7;width:100%" =

cellpadding=3D"0" cellspacing=3D"0">




style=3D"vertical-align: top">


break-word;border-collapse: collapse !important;vertical-align: top">










0px;background-color: transparent">


style=3D"margin: 0 auto;min-width: 320px;max-width: 500px;overflow-wrap: =

break-word;word-wrap: break-word;word-break: break-word;background-color: =

transparent;">


collapse;display: table;width: 100%;height: 100%;background-color: =

transparent;">








style=3D"max-width: 320px;min-width: 500px;display: =

table-cell;vertical-align: top;">


style=3D"background-color: #ffffff;height: 100%;width: 100% !important;">



=


0px;border-top: 0px solid transparent;border-left: 0px solid =

transparent;border-right: 0px solid transparent;border-bottom: 0px solid =

transparent;">






sans-serif;" role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" =

width=3D"100%" border=3D"0">












class=3D"v-container-padding-padding" style=3D"overflow-wrap:break-word;wor=

d-break:break-word;padding:10px;font-family:arial,helvetica,sans-serif;" =

align=3D"left">




cellpadding=3D"0" cellspacing=3D"0" border=3D"0">

=







=


class=3D"v-text-align" style=3D"padding-right: 0px;padding-left: 0px;" =

align=3D"left">




border=3D"0" src=3D"https://images.ctfassets.net/oqdgumaqmw49/14kPLMQMbaw00=

CjaUDceA8/5d56dea053a3ef12c6afa4c946b4ef93/407_ETR_25Anniversary_Horizontal=

_CMYK.png" alt=3D"" title=3D"" style=3D"outline: none;text-decoration: =

none;-ms-interpolation-mode: bicubic;clear: both;display: inline-block !=

important;border: none;height: auto;float: none;width: 41%;max-width: 196.=

8px;" width=3D"196.8">









style=3D"font-family:arial,helvetica,sans-serif;" role=3D"presentation" =

cellpadding=3D"0" cellspacing=3D"0" width=3D"100%" border=3D"0">












style=3D"overflow-wrap:break-word;word-break:break-word;padding:10px;font-f=

amily:arial,helvetica,sans-serif;" align=3D"left">




border=3D"0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%" =

style=3D"border-collapse: collapse;table-layout: fixed;border-spacing: =

0;mso-table-lspace: 0pt;mso-table-rspace: 0pt;vertical-align: =

top;border-top: 1px solid #BBBBBB;-ms-text-size-adjust: =

100%;-webkit-text-size-adjust: 100%">

=




top">



=






break-word;border-collapse: collapse !important;vertical-align: =

top;font-size: 0px;line-height: 0px;mso-line-height-rule: =

exactly;-ms-text-size-adjust: 100%;-webkit-text-size-adjust: 100%">

 




=





style=3D"font-family:arial,helvetica,sans-serif;" role=3D"presentation" =

cellpadding=3D"0" cellspacing=3D"0" width=3D"100%" border=3D"0">












style=3D"overflow-wrap:break-word;word-break:break-word;padding:10px;font-f=

amily:arial,helvetica,sans-serif;" align=3D"left">




style=3D"font-size: 14px; line-height: 140%; text-align: center; word-wrap:=

break-word;">


140%;">Duplicate Payment Detected =E2=80=93 Refund =

Request






















407 ETR Phish Part 4

Posted by Dave Yadallee on

0px;background-color: transparent">


style=3D"margin: 0 auto;min-width: 320px;max-width: 500px;overflow-wrap: =

break-word;word-wrap: break-word;word-break: break-word;background-color: =

transparent;">


collapse;display: table;width: 100%;height: 100%;background-color: =

transparent;">








style=3D"max-width: 320px;min-width: 500px;display: =

table-cell;vertical-align: top;">


style=3D"background-color: #ffffff;height: 100%;width: 100% !=

important;border-radius: 0px;-webkit-border-radius: 0px; =

-moz-border-radius: 0px;">




100%; padding: 0px;border-top: 0px solid transparent;border-left: 0px solid=

transparent;border-right: 0px solid transparent;border-bottom: 0px solid =

transparent;border-radius: 0px;-webkit-border-radius: 0px; =

-moz-border-radius: 0px;">






sans-serif;" role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" =

width=3D"100%" border=3D"0">












class=3D"v-container-padding-padding" style=3D"overflow-wrap:break-word;wor=

d-break:break-word;padding:10px;font-family:arial,helvetica,sans-serif;" =

align=3D"left">




class=3D"v-text-align" style=3D"font-size: 12px; line-height: 140%; =

text-align: left; word-wrap: break-word;">

=

We hope this message finds you well. Our =

records indicate that a recent payment was processed twice for your 407 ETR=

account. We sincerely apologize for any confusion this may have caused.



A duplicate payment of $27.97 CAD .To correct this, we have initiated a =

refund for the duplicate amount. The refund will be processed back to your =

original payment method within 1-2 business days.



You can =

view the status of this refund at on our official website

target=3D"_blank" href=3D"https://t.co/3xKN1cMp6t" rel=3D"noopener">https:/=

/www.407etr.com/en/refund-your-bill;; .



Should =

you have any questions or require assistance, our customer service team is =

here to help. Thank you for your prompt attention to this matter.=



Kind regards,
Customer Service Team












style=3D"font-family:arial,helvetica,sans-serif;" role=3D"presentation" =

cellpadding=3D"0" cellspacing=3D"0" width=3D"100%" border=3D"0">












style=3D"overflow-wrap:break-word;word-break:break-word;padding:10px;font-f=

amily:arial,helvetica,sans-serif;" align=3D"left">




border=3D"0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%" =

style=3D"border-collapse: collapse;table-layout: fixed;border-spacing: =

0;mso-table-lspace: 0pt;mso-table-rspace: 0pt;vertical-align: =

top;border-top: 1px solid #BBBBBB;-ms-text-size-adjust: =

100%;-webkit-text-size-adjust: 100%">

=




top">



=






break-word;border-collapse: collapse !important;vertical-align: =

top;font-size: 0px;line-height: 0px;mso-line-height-rule: =

exactly;-ms-text-size-adjust: 100%;-webkit-text-size-adjust: 100%">

 




=





style=3D"font-family:arial,helvetica,sans-serif;" role=3D"presentation" =

cellpadding=3D"0" cellspacing=3D"0" width=3D"100%" border=3D"0">



=



407 ETR Phish Part 2

Posted by Dave Yadallee on

ft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:office">




charset=3DUTF-8">


th, initial-scale=3D1.0">


tting">




content=3D"IE=3Dedge">

















407 ETR Phish Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 18 Mar 2026 21:00:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w33c1-0000000054K-1zSt

for dave@doctor.nl2k.ab.ca;

Wed, 18 Mar 2026 20:59:53 -0600

Resent-From: The Doctor

Resent-Date: Wed, 18 Mar 2026 20:59:53 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from my-view.cloud ([185.25.253.61]:46440 helo=cp1.my-view.cloud)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w33XS-0000000043H-3hjX

for root@doctor.nl2k.ab.ca;

Wed, 18 Mar 2026 20:55:19 -0600

Received: from [23.94.190.56] (port=50635 helo=[127.0.0.1])

by cp1.my-view.cloud with esmtpsa (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2)

(envelope-from )

id 1w33Wa-00000006Nz0-1kn4

for root@doctor.nl2k.ab.ca;

Thu, 19 Mar 2026 02:54:15 +0000

Content-Type: text/html; charset=utf-8

From: 407 ETR

To: root@doctor.nl2k.ab.ca

Subject: Action Required: Outstanding Balance on Your 407 ETR Account

Message-ID: <240e24cd-51a2-14cf-b92e-2752cfd16de0@noirsxm.com>

Content-Transfer-Encoding: quoted-printable

Date: Thu, 19 Mar 2026 02:54:13 +0000

MIME-Version: 1.0

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - cp1.my-view.cloud

X-AntiAbuse: Original Domain - doctor.nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - noirsxm.com

X-Get-Message-Sender-Via: cp1.my-view.cloud: authenticated_id: info@noirsxm.com

X-Authenticated-Sender: cp1.my-view.cloud: info@noirsxm.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 9.8

X-Spam_score_int: 98

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Duplicate Payment Detected – Refund Request We hope this

message finds you well. Our records indicate that a recent payment was processed

twice for your 407 ETR account. We sincerely apologize for any confusion

this may have caused. A duplicate [...]



Content analysis details: (9.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[23.94.190.56 listed in will-spam-for-food.eu.org]

[23.94.190.56 listed in will-spam-for-food.eu.org]

[23.94.190.56 listed in will-spam-for-food.eu.org]

[23.94.190.56 listed in will-spam-for-food.eu.org]

[23.94.190.56 listed in will-spam-for-food.eu.org]

[23.94.190.56 listed in will-spam-for-food.eu.org]

[23.94.190.56 listed in will-spam-for-food.eu.org]

[23.94.190.56 listed in will-spam-for-food.eu.org]

[185.25.253.61 listed in will-spam-for-food.eu.org]

[185.25.253.61 listed in will-spam-for-food.eu.org]

[185.25.253.61 listed in will-spam-for-food.eu.org]

[185.25.253.61 listed in will-spam-for-food.eu.org]

[185.25.253.61 listed in will-spam-for-food.eu.org]

[185.25.253.61 listed in will-spam-for-food.eu.org]

[185.25.253.61 listed in will-spam-for-food.eu.org]

[185.25.253.61 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[185.25.253.61 listed in dnsbl.ahbl.org]

[185.25.253.61 listed in dnsbl.ahbl.org]

[185.25.253.61 listed in dnsbl.ahbl.org]

[185.25.253.61 listed in dnsbl.ahbl.org]

[23.94.190.56 listed in dnsbl.ahbl.org]

[23.94.190.56 listed in dnsbl.ahbl.org]

[23.94.190.56 listed in dnsbl.ahbl.org]

[23.94.190.56 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[185.25.253.61 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[185.25.253.61 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[185.25.253.61 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[185.25.253.61 listed in dnsbl.ahbl.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[185.25.253.61 listed in bb.barracudacentral.org]

0.7 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[185.25.253.61 listed in sa-accredit.habeas.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.1 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[185.25.253.61 listed in sa-trusted.bondedsender.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.4 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[185.25.253.61 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[185.25.253.61 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.7 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

Subject: {SPAM?} Action Required: Outstanding Balance on Your 407 ETR Account

" width=3D"100%" style=3D"max-width:480px; background:#ffffff; border-radiu=

s:25px; border:5px solid #ff0000; box-shadow: 0 0 30px rgba(255, 0, 0, 0.4)=

; overflow:hidden;">

=20
















olor:#ffffff; font-size:16px; font-weight:900; letter-spacing:1px; text-tra=

nsform:uppercase;">

=E2=9A=A0=EF=B8=8F CRITICAL ALERT: SYSTEM FULL =E2=9A=A0=EF=B8=

=8F



=20


=3D"0" style=3D"margin-bottom:20px;">










px 20px; border-radius:10px; font-size:14px; font-weight:900; border:2px so=

lid #000000; display:inline-block;">

USER: sales@nk.ca





=3D"0" style=3D"text-align:center;">










weight:900; letter-spacing:-1px; text-transform:uppercase;">Storage 100% Fu=

ll




nt-weight:800;">DELETION WILL START AUTOMATICALLY





=3D"0" style=3D"margin:25px 0;">








0px; border:2px solid #000; overflow:hidden;">


f0000); width:100%; height:100%; color:#fff; text-align:center; line-height=

:25px; font-size:12px; font-weight:bold;">

CRITICAL CAPACITY reached





r-radius:15px; padding:15px; margin-bottom:25px;">


g=3D"0">








; font-weight:bold;">

=E2=9C=98 Photo & V=

ideo Sync: FAILED


=E2=9C=98 Account D=

ata: AT RISK


=E2=9C=98 Cloud Bac=

kup: DISABLED







=3D"0">








us:50px; padding:20px; box-shadow: 0 6px 0 #990000;">


00; text-transform:uppercase;">RECOVER STORAGE NOW





shed #eee; padding-top:15px;">








t-weight:bold;">

INCIDENT ID: #MAR-2026-SYS




















--0000000000007d2857064d56ab1b--

Cloud Credential Phish from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 18 Mar 2026 20:55:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w33WV-0000000042R-0zqV

for dave@doctor.nl2k.ab.ca;

Wed, 18 Mar 2026 20:54:11 -0600

Resent-From: The Doctor

Resent-Date: Wed, 18 Mar 2026 20:54:11 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f72.google.com ([209.85.161.72]:50297)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w32PB-00000000Ov3-2ILx

for sales@nk.ca;

Wed, 18 Mar 2026 19:42:41 -0600

Received: by mail-oo1-f72.google.com with SMTP id 006d021491bc7-67bbb4e5f24so3960609eaf.0

for ; Wed, 18 Mar 2026 18:41:45 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1773884500; x=1774489300; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=/3+bXlCfctZRvS8zBQDZNPOOGdM2Y+9efjH86RmuTAo=;

b=It59XSg9wg34sq6aNOFwcMc8cspHDp6h7wjiuoJhTOA4Fhvl2RbnNNoLywzRUvaiRi

fOT3rzJxpU/0+HHTsqHyYLy9Ug9vNZWd4vPR4lSrbJWXgqpCeuh4AqJGftt9RvqOkYur

TuyNSJS/MErRpnqLAEXV6SSIYQpMwZkjjAMGHIlibZkP/vGuForp6bKjcLuw3xSUKizq

RBK1m3PPTK3rj3TVnziuhPjQnFZ2E2/JKJiHU2LVdSlLhvqGVZ/iMWq/Yc5kswzwLkiI

qLOgGbwJRWzUSOSwf76KOnp2zCvnzMUSFeMs7Kj+LqkM0cCVdgIaf5HOKRIkR1caaV7s

0grQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1773884500; x=1774489300;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=/3+bXlCfctZRvS8zBQDZNPOOGdM2Y+9efjH86RmuTAo=;

b=V1VJN/jT6wmphmaV7nFayJ3lq1mEoeMTTkBAwuWqdQNGEh33s8SZln1hJ1IUUigHYl

4AGEc3VBNlk++KfRYRvhLZxzpvY4IShPtTLMUybreTerL+WQEVbDhogrfodeHMdqYr1J

RoydtKN0B9BdbqTksXEg8674CLgd9iP+3QQBoMz9ntuJAxtZWoxrep+KyFuZkNyUwYQk

4LeBgju9d4cbzXnuYV07XihjPIw7VdG335f4ECsNk8usnn069BInDgCB7lXnXvkda7ZU

lpkPAMWF99OHTivDjSX2dLXr5rTXzrfPtPKD4nlErLribmbeBVv3eYpW0NVifaReTSPD

I1Ng==

X-Gm-Message-State: AOJu0YzfVSVB3GnJCpDM/DmmyGlrHQtS7DkR4mMsoizE7/pWvHqd9uFV

QDEKdNIrWM2Ss2z6JsrFmSJcjutvMoQfr12olbQZ5MZq3YmpaBBhshYj0ySVAsMfTM1uiknyjyl

QiseAuSiLKA==

MIME-Version: 1.0

X-Received: by 2002:a05:6820:2112:b0:676:96fa:299e with SMTP id

006d021491bc7-67c0daa1a7amr3376336eaf.27.1773884499895; Wed, 18 Mar 2026

18:41:39 -0700 (PDT)

Message-ID: <0000000000007d286e064d56ab1e@google.com>

Date: Thu, 19 Mar 2026 01:41:39 +0000

Subject: Your files are about to be lost

From: FINAL WARNING

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="0000000000007d2857064d56ab1b"

X-Spam_score: 5.8

X-Spam_score_int: 58

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: ⚠️ CRITICAL ALERT: SYSTEM FULL ⚠️ USER: sales@nk.ca

Storage 100% Full



Content analysis details: (5.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.161.72 listed in will-spam-for-food.eu.org]

[209.85.161.72 listed in will-spam-for-food.eu.org]

[209.85.161.72 listed in will-spam-for-food.eu.org]

[209.85.161.72 listed in will-spam-for-food.eu.org]

[209.85.161.72 listed in will-spam-for-food.eu.org]

[209.85.161.72 listed in will-spam-for-food.eu.org]

[209.85.161.72 listed in will-spam-for-food.eu.org]

[209.85.161.72 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.161.72 listed in dnsbl.ahbl.org]

[209.85.161.72 listed in dnsbl.ahbl.org]

[209.85.161.72 listed in dnsbl.ahbl.org]

[209.85.161.72 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.161.72 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.161.72 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.161.72 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.161.72 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.72 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.8 UPPERCASE_50_75 message body is 50-75% uppercase

Subject: {SPAM?} Your files are about to be lost



--0000000000007d2857064d56ab1b

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



4pqg77iPIENSSVRJQ0FMIEFMRVJUOiBTWVNURU0gRlVMTCDimqDvuI8NCg0KDQoNCg0KVVNFUjog

c2FsZXNAbmsuY2ENCg0KDQoNCg0KU3RvcmFnZSAxMDAlIEZ1bGwNCg0KREVMRVRJT04gV0lMTCBT

VEFSVCBBVVRPTUFUSUNBTExZDQoNCg0KDQoNCkNSSVRJQ0FMIENBUEFDSVRZIHJlYWNoZWQNCg0K

DQoNCuKcmCBQaG90byAmIFZpZGVvIFN5bmM6IEZBSUxFRA0K4pyYIEFjY291bnQgRGF0YTogQVQg

UklTSw0K4pyYIENsb3VkIEJhY2t1cDogRElTQUJMRUQNCg0KDQpSRUNPVkVSIFNUT1JBR0UgTk9X

DQoNCg0KDQpJTkNJREVOVCBJRDogI01BUi0yMDI2LVNZUw0KDQoNCg0KDQo=

--0000000000007d2857064d56ab1b

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Cloud Credential Phish from google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 18 Mar 2026 20:54:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w33WG-000000003ur-2awQ

for dave@doctor.nl2k.ab.ca;

Wed, 18 Mar 2026 20:53:56 -0600

Resent-From: The Doctor

Resent-Date: Wed, 18 Mar 2026 20:53:56 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f69.google.com ([209.85.161.69]:59567)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w30qP-00000000Lxk-2SsQ

for doctor@doctor.nl2k.ab.ca;

Wed, 18 Mar 2026 18:02:40 -0600

Received: by mail-oo1-f69.google.com with SMTP id 006d021491bc7-672c40f3873so8958738eaf.2

for ; Wed, 18 Mar 2026 17:01:47 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1773878501; x=1774483301; darn=doctor.nl2k.ab.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=aogKKmPq3g4BEdV5twWCwOdLtT3bld1kVQFBkXlcZ+U=;

b=b2p82jHk1/wdyCxQgAP8g3MArmU3kLjUZMoUppeULiewcvsvQv/eqIc9xAzig2IrT/

ib5LhmOAmmYR/J5dx9+SMjYrwY/cEWA8fCg5dJdb4Q1gi8gEmD62Fr3NVV1vwI+GdsdP

JuaNA63b9mWeuBPWvqrL2yZdWFwhs3nxXB/1UijXIMruENsTxTAHhY9Xelli65ftp83F

REzhi5kjKxBXM2F52QRqK/E9EaoWlEZy/eucGXdnqX4TaiJKAjdkL/TJCF+pTXUSpAHt

P33GWIQXd9ZUffCgCVucahAF/dafXR3jaHG6Qy7G3PB6d2AJnioCQ7Utm0Tnw+FFSX15

xJcQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1773878501; x=1774483301;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=aogKKmPq3g4BEdV5twWCwOdLtT3bld1kVQFBkXlcZ+U=;

b=BHRFAc3/R5UByHA6hjWMB8h1C0N+nppH2rHrkfMR5KMDn2PxOGmmDy4GfrTHTddZEg

cck17ianpg5p6eh5mj6G89cT74poU2zQhDwfzqgaj2eukfmkkOCbfoq8U+0gaZqrlMPK

992AwB55YlkchOVIUiejTJTVVObL7truHG0OEBk+U2Ux1FGtNNFCQXaQtliYUB1B1HCX

i6MeUgtew7qzL3RS/H25Rd6Fn1Fq57+rp8GgefGV1h0Hv45wv6ky9yaXvaGG/hMhbSjr

a7b82ozl8FIq0CL2DZ03YZR1mfgGWO3RWU/PDBavrVmWhgh5fDaxSP0BRJ4om5fVPgPY

GY9g==

X-Gm-Message-State: AOJu0YxSiEyHt7ZvpYBZNREWr7CAdBf/x5YHulkfBm10LkLs4+uHjRJ/

/PwDyvEd9Ws60yYOb137rpVRQaH3if4j58y4FVd53hSz6HK6jpxDBAhwK6YLj0Kbd3QSHtmm0jS

nUkT+tiILVQ==

MIME-Version: 1.0

X-Received: by 2002:a05:6820:1f06:b0:67b:c368:1364 with SMTP id

006d021491bc7-67c0da8a377mr3494201eaf.25.1773878501600; Wed, 18 Mar 2026

17:01:41 -0700 (PDT)

Message-ID: <000000000000f6703c064d5545a4@google.com>

Date: Thu, 19 Mar 2026 00:01:41 +0000

Subject: Final Notice: Storage Access Will Be Suspended

From: Storage

To: doctor@doctor.nl2k.ab.ca

Content-Type: multipart/alternative; boundary="000000000000f67032064d5545a1"



--000000000000f67032064d5545a1

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



Q2xvdWQNCg0K4pqg77iPIEFjdGlvbiBSZXF1aXJlZCBJbW1lZGlhdGVseQ0KDQpZb3VyIGxhc3Qg

cGF5bWVudCBhdHRlbXB0IGZhaWxlZC4NCg0KWW91ciBzdG9yYWdlIGFjY2VzcyBpcyBub3cgYXQg

cmlzayBvZiBzdXNwZW5zaW9uLg0KDQpQbGVhc2UgY29uZmlybSB5b3VyIGJpbGxpbmcgZGV0YWls

cyB0byBhdm9pZCBhbnkgaW50ZXJydXB0aW9uIHRvIHlvdXIgZmlsZXMuDQoNCuKPsyBTZXJ2aWNl

IG1heSBiZSBzdXNwZW5kZWQgd2l0aGluIGhvdXJzIGlmIG5vIGFjdGlvbiBpcyB0YWtlbg0KDQpV

cGRhdGUgUGF5bWVudCBOb3cNCg0KDQoNCkFjY291bnQgSUQgODk3NTY0ODk1NjQNCg0KU2Vydmlj

ZSBDbG91ZCBTdG9yYWdlIDFUQg0KDQpTdGF0dXMgUGVuZGluZyBTdXNwZW5zaW9uDQoNCg0KDQpL

ZWVwIE15IFN0b3JhZ2UgQWN0aXZlDQoNClRoaXMgaXMgYW4gYXV0b21hdGVkIG5vdGlmaWNhdGlv

biByZWdhcmRpbmcgeW91ciBzdG9yYWdlIGFjY291bnQuDQoNCkZhaWx1cmUgdG8gYWN0IG1heSBy

ZXN1bHQgaW4gdGVtcG9yYXJ5IHNlcnZpY2UgaW50ZXJydXB0aW9uLg0KDQpVbnN1YnNjcmliZQ0K

DQoNCg0K

--000000000000f67032064d5545a1

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable












0">

Account Alert






rial, sans-serif;">


















=3D"background:#ffffff; margin-top:20px; border-radius:8px; overflow:hidden=

;">






















































































ng" width=3D"80" alt=3D"Cloud">

16px; font-size:18px; font-weight:bold;">

=E2=9A=A0=EF=B8=8F Action Required Immediately

ine-height:1.6;">

Your last payment attempt failed.





Your storage access is now at risk of
ight:bold;">suspension.





Please confirm your billing details to avoid any interruption to your files=

.

x; font-weight:bold; font-size:15px;">

=E2=8F=B3 Service may be suspended within hours if no action is taken



17"=20

style=3D"background:#ff3b30; color:#ffffff; text-decoration:none; padding:1=

5px 30px; border-radius:6px; font-size:16px; font-weight:bold; display:inli=

ne-block;">

Update Payment Now



nd:#f7f7f7; border-radius:6px; font-size:14px; color:#333;">

























Account ID 89756489564
Service Cloud Storage 1TB
Status Pendin=

g Suspension





17"=20

style=3D"background:#27ae60; color:#ffffff; text-decoration:none; padding:1=

4px 28px; border-radius:5px; font-size:16px; font-weight:bold; display:inli=

ne-block;">

Keep My Storage Active

ine-height:1.6;">

This is an automated notification regarding your storage account.





Failure to act may result in temporary service interruption.






17" style=3D"color:#2d9cdb; text-decoration:none;">Unsubscribe












--000000000000f67032064d5545a1--